9.2 Copilot Studio Protection and Agent Management

9.2 Copilot Studio Protection and Agent Management

Quick Answer: Secure Microsoft Copilot Studio agents with built-in runtime protections, enable real-time protection so Defender (or another threat provider) can block unsafe tool actions before execution, and govern the agent fleet in the Microsoft 365 admin center (plus Power Platform admin surfaces). Treat citizen-built agents as high-risk apps if over-permissioned.

SC-500 skills measured call out two operational bullets you must not confuse:

• Enable and configure real-time protection for Microsoft Copilot Studio agents
• Manage agents in Microsoft 365 admin center

Together they form the agent runtime + admin governance layer of Security for AI—between Purview data posture (previous section) and Entra Agent ID (next section).

What Copilot Studio agents are (security mindset)

Microsoft Copilot Studio is Microsoft’s low-code / pro-code platform for building custom agents (formerly often discussed as bots/agents with topics, knowledge, actions/tools, and channels). Agents can:

• Answer from knowledge sources (for example SharePoint, uploaded files, Graph connectors depending on design)
• Call tools/actions (Power Platform connectors, APIs, MCP-style tool integrations where configured)
• Be published to Teams, Microsoft 365 Copilot, websites, and other channels
• Be built by professional developers or citizen makers in business units

From a security engineer’s perspective, an agent is a non-human workflow that can read enterprise content and take actions (send email, update records, call APIs). That is a privileged automation surface—not a toy chatbot.

Built-in protections vs real-time protection

Microsoft documentation emphasizes that custom agents in Copilot Studio are secure by default with built-in protections against classes of threats such as user prompt-injection attacks (UPIA) and cross-domain prompt injection attacks (XPIA). At runtime, the platform can block many of these attack types to reduce data exfiltration risk.

Real-time protection goes further: you connect an external threat detection / monitoring system so that during the agent’s decision loop, an external security engine evaluates planned activity and can block unsafe actions before they execute—even if the agent “intends” to run them.

How real-time protection works (exam-level model)

Microsoft has documented real-time protection for AI agents using Microsoft Defender, including coverage paths for Copilot Studio agents (tool invocation evaluation). Related experiences also appear under Security for AI in the Defender portal and transitions toward Microsoft Agent 365 control-plane capabilities. Product surfaces evolve; for SC-500, remember the capability: near-real-time evaluation and block of risky agent tool actions, not a specific marketing badge year.

Where admins configure it

Common admin paths described in Microsoft materials:

• Power Platform admin center → Security → Threat detection / additional threat detection setup for environments (allow Copilot Studio to share data with a threat detection provider; register Entra app ID and provider endpoint as required).
• Scope by environment, multiple environments, or environment groups; different environments can use different monitoring systems; integration can be disabled with a single setting when needed.
• Microsoft Defender documentation for protect AI agents in real time describes prerequisites such as enabling security for AI agents / connectors and ensuring Copilot Studio is connected for Copilot Studio coverage.

Exam trap: Real-time protection is not the same as Purview DSPM oversharing assessment. DSPM finds bad data exposure. Real-time protection stops bad agent actions at runtime.

Manage agents in Microsoft 365 admin center

The Microsoft 365 admin center is the organization-facing control plane for managing agents used with Microsoft 365 Copilot and related experiences. Microsoft documentation covers admin abilities to:

• Inventory agents available to the organization
• Enable / disable agents
• Assign agents to users or groups (where licensing and publishing model allow)
• Block or remove agents that violate policy
• Review usage and related Copilot agent reports
• Manage integrated apps / agent publication paths (including approval workflows for organization-wide availability)

Agents may originate from multiple maker surfaces (Copilot Studio, agent builder experiences, SharePoint agents, partner apps). The security engineer’s operational question is: Do we know every agent that can touch our data, who can use it, and can we shut it off quickly?

Microsoft Agent 365 (control plane direction)

Microsoft positions Microsoft Agent 365 as a broader control plane for AI agents—deploy, govern, and manage agents at scale regardless of where they were built. Agent inventory and security capabilities continue to consolidate toward Agent 365 experiences in Microsoft 365 admin center / Defender security-for-AI settings. For SC-500, map Agent 365 to fleet governance, while still knowing Copilot Studio real-time protection and M365 admin agent management as named blueprint skills.

Governance of citizen-developed agents

Citizen development is a feature, not a bug—until connectors are wide open.

Risks of citizen-built agents

Practical governance model (what SC-500 wants you to reason about)

1. Environments — Separate maker sandboxes from production; do not let everyone publish production agents into the default environment.
2. Maker permissions — Who can create agents, use premium connectors, or share widely?
3. Connector and DLP policies — Treat agent tools like Power Platform connectors with business/non-business/blocked classifications.
4. Publishing controls — Require admin approval for organization-wide availability in Teams / Microsoft 365 Copilot.
5. Runtime protection — Enable real-time threat evaluation for production environments hosting agents that can send data externally.
6. Inventory & response — Use Microsoft 365 admin center / Agent inventory to disable a risky agent within minutes of an incident.
7. Identity — Prefer governed Microsoft Entra Agent ID for agents (next section) over opaque shared secrets in custom HTTP actions.

Over-permissioned agents: exam scenarios

Scenario A — “Helpful” sales agent

A sales maker builds a Copilot Studio agent with:

• Knowledge: entire company SharePoint (including HR and Legal sites the maker can open)
• Tools: Outlook send, SharePoint create file, public HTTP connector

A customer email contains indirect prompt-injection text. Without strong runtime controls, the agent might attempt to email internal pricing sheets externally.

Correct layered response:

1. Reduce knowledge sources to the approved sales library.
2. Remove unnecessary tools (especially unrestricted HTTP and broad SharePoint write).
3. Enable real-time protection to block oversharing tool calls.
4. Align SharePoint ACLs + Purview DSPM so the maker cannot ground on HR/Legal in the first place.
5. If published org-wide without review, block the agent in Microsoft 365 admin center until fixed.

Scenario B — Agent works in demo, fails audit

Audit asks: “List all agents that can email customers.” If the security team only monitors Azure subscriptions, they miss Copilot Studio. SC-500 correct instinct: Microsoft 365 admin center agent management + Power Platform inventory, not only Azure Resource Graph.

Relationship to other AI security controls

SC-500 traps

1. Real-time protection = only logging — It is designed to block risky actions pre-execution when configured for protection, not merely SIEM after-the-fact (logging is additional value).
2. Citizen agents need no governance because “they’re just bots” — False; tools + knowledge create enterprise risk.
3. Managing agents only in Azure portal — Primary agent fleet management for M365 Copilot scenarios is Microsoft 365 admin center (and Power Platform for Studio environments).
4. Confusing Security Copilot (SOC assistant product) with Copilot Studio agents — different products.
5. Assuming built-in UPIA/XPIA means no need for Defender real-time rules — Built-in helps; real-time external evaluation is the explicit SC-500 skill for enhanced protection.

Implementation checklist

1. Inventory agents in Microsoft 365 admin center; identify owners, channels, and sharing scope.
2. Classify agents by risk (read-only FAQ vs tools that email, write, or call external APIs).
3. Harden production Power Platform environments (DLP, connector policies, limited makers).
4. Enable real-time / external threat detection for environments hosting high-risk Copilot Studio agents; connect Microsoft Defender where licensed and documented.
5. Document data-sharing implications of real-time evaluation with compliance stakeholders.
6. Establish publish approval for org-wide agents; practice a “break glass disable agent” drill.
7. Link each production agent’s identity story to Entra Agent ID governance (next section).

Bottom line: SC-500 wants you to run agents like production software—protect the runtime, manage the inventory, and starve over-permissioned citizen automations of unnecessary knowledge and tools.